https://flatt.tech/research/tags/clone2leak/ Recent content in Clone2Leak on GMO Flatt Security Research Hugo en Sun, 26 Jan 2025 00:00:00 +0000 https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to-us/ Sun, 26 Jan 2025 00:00:00 +0000 https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to-us/ <h2 id="introduction">Introduction</h2> <p>Hello, I&rsquo;m RyotaK ( <a href="https://twitter.com/ryotkak" target="_blank" rel="noopener">@ryotkak</a> ), a security engineer at GMO Flatt Security Inc.</p> <p>In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise Server for a while, I felt bored and decided to try to find bugs on GitHub Desktop instead.</p> <p>After reading the source code of GitHub Desktop, I found a bug that allows a malicious repository to leak the user&rsquo;s credentials.<br> Since the concept of the bug is interesting, I decided to investigate other Git-related projects and found many bugs.</p>